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APOLLO EXPERIENCE REPORT 

SAFETY ACTIVITIES 

By Charles N. Rice 
Lyndon B. Johnson Space Center 

SUMMARY 


The success of the United States manned space-flight program has been, to a 
great extent, a direct result of the emphasis placed on safety by NASA management. 
The reorganization of the NASA Lyndon B. Johnson Space Center (formerly the Manned 
Spacecraft Center) safety efforts after the Apollo spacecraft 204 fire was necessary 
for a concerted safety effort. All the relevant safety activities were coordinated 
through a single office and resulted in a strong, centralized approach to crew and 
mission safety. The establishment of a formal documented hazard analysis for each 
mission was effective in identifying significant hazards and assuring satisfactory 
resolution of hazards at an appropriate high level in the Lyndon B. Johnson Space 
Center organization. 

A safety program requires an adequate complement of qualified engineers, a 
free hand to conduct independent assessments, and the full support of top management. 
With these ingredients, an effective safety program is assured. 

The Manned Flight Awareness Program introduced early in the Apollo Program 
was a motivational program to achieve a high level of safety, reliability, and quality 
consciousness of all program participants. Its success was greatly enhanced by 
astronaut participation. 


INTRODUCTION 


The success of the United States manned space-flight program has been, to a 
great extent, a direct result of the emphasis placed on safety by NASA management. 
The basic safety objective has been to identify hazards and to ensure that these hazards 
are either eliminated or reduced to an acceptable level. With the exceptions of the 
Apollo spacecraft (SC) 204 fire and perhaps the Apollo 13 mission, the hazards had 
been adequately identified and properly resolved. Throughout the series of manned 
space-flight programs (Mercury, Gemini, and Apollo), the safety of the crew was 
given primary consideration during hardware design, manufacturing, testing, mission 
planning, and flight operations. 


The purpose of this paper is to summarize the safety- oriented activities of 
personnel at the NASA Lyndon B. Johnson Space Center (JSC) (formerly the Manned 
Spacecraft Center (MSC)) and at major contractor plant sites. Although everyone is 
expected to be safety conscious, some things that are inherently unsafe under certain 
conditions are not easily recognized. The identification of hazards requires a 
dedicated and conscious effort by appropriately trained safety personnel who possess 
the experience and capability to properly assess the risks throughout all phases of 
the manned program and to take appropriate action to eliminate or reduce the risks 
to an acceptable level. 

During Project Mercury, the Gemini Program, and the early stages of the 
Apollo Program, a Flight Safety Office at MSC reported to the Center Director. The 
function of this office was to coordinate the overall safety effort at NASA and the 
major contractors. It had a small staff and acted in an advisory capacity to each 
program office. Throughout Project Mercury and the Gemini Program, 'crew safety 
and mission safety activities were carried out by the Flight Safety Office, the respon- 
sible program offices, and the engineering and other support groups at both NASA 
centers and major contractors. This method worked well because the groups were 
small enough for the individuals to maintain good communications, were personally 
known to each other, and had a broad view of the requirements so that the safety 
efforts were well integrated. 

As the Apollo Program progressed from design definition to hardware fabrica- 
tion, substantial numbers of new personnel were added to the program, numerous 
reassignments of personnel were made, and functional reorganizations were imple- 
mented over a period of months. Coupled with these changes, the hardware testing 
phases brought added activity, and the resolution of test hardware failures absorbed 
more and more time. During this period, the size and technical makeup of the Flight 
Safety Office did not grow sufficiently to maintain visibility into the rapidly expanding 
Apollo Spacecraft Program hardware and procedures activities. All the above 
resulted in some loss of communication and visibility between the Flight Safety Office 
and the engineering and test operational elements. 

After the Apollo SC -204 fire, one of the organizational changes made at MSC 
grouped most of the Center safety organizations into the Flight Safety Office reporting 
directly to the Center Director. Another change was the creation of a staff position 
in the Apollo Spacecraft Program Office (ASPO) as the MSC point of contact with the 
Apollo Systems Safety Office at NASA Headquarters. This staff position, called the 
ASPO Assistant Program Manager for Flight Safety, was a position designed to 
expedite implementation of the MSC Flight Safety Office policies and procedures. 

This provided a good opportunity to integrate the efforts of the MSC Flight Safety 
Office and the ASPO flight safety activities. The arrangement worked very well by 
opening up the communications channels between the various groups working different 
aspects of flightcrew and mission safety. At the same time, several reliability and 
quality assurance elements at MSC were also combined into a single office reporting 
directly to the Center Director. Although these changes in the reliability and quality 
assurance (R&QA) organizations did not directly affect the Flight Safety Office, they 
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had the indirect effect of making available, on a day-to-day basis, data and information 
that were essential to Flight Safety Office personnel in performing their tasks. This 
interchange and coordination was aided by placing both organizations under the direc- 
tion of one person. 

A further enhancement of the MSC Flight Safety Office capabilities occurred 
in late 1967 when additional support (contract) manpower was made available to the 
Flight Safety Office; this support consisted of experienced engineers trained in 
safety techniques and procedures. The local MSC group was part of a larger contract 
covering engineering and safety at MSC, NASA Headquarters, and the other NASA 
centers involved in the manned space-flight effort; thus, a large reservoir of experi- 
enced engineering talent was available to provide assistance when required. These 
changes, both organizational and personnel, were sufficient to reestablish a planned, 
orderly, and coordinated approach to crew and mission safety. 


THE MSC SAFETY OFFICE ACTIVITIES 


Evolution of Systems Safety Discipline 

Under the new organization previously described, the MSC Safety Office activi- 
ties were defined as follows. 

1. To examine all phases of each mission for hazards (i.e. , flight plans, crew 
procedures, mission rules, design changes, contingency plans, training, etc.) 

2. To examine all mission-related ground activities that involved the flightcrews 
and backup crews for hazards (i.e. , extravehicular- activity (EVA) procedures, crew 
training, ground test and checkout, simulated flight tests, vacuum chamber tests, 
recovery training, etc.) 

3. To assure that hazards identified in items (1) and (2) were appropriately 
resolved for future missions and ground operations (Resolution of hazards was to 
be accomplished through normal channels used to implement the Apollo Spacecraft 
Program. ) 

As a part of the foregoing effort, the safety offices of the major contractors 
were strengthened to ensure the proper integration of their own and their subcon- 
tractors’ safety efforts. The MSC did not require that the subcontractors institute 
a dedicated safety office; it was considered that the responsibility for safety should 
rest with the major contractors who would eventually receive the hardware/software 
from the subcontractors. In this manner, the major contractors maintained an 
overall safety effort' with their own safety staffs. The approach proved acceptable. 

The Safety Office personnel conducted their duties by active participation in 
design reviews, test procedure reviews, and the development of crew procedures. 

As safety issues were identified, they were resolved immediately or were presented 
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to the ASPO for resolution at scheduled meetings and milestone reviews. Typical 
reviews that safety personnel participated in are as follows: 

1. Configuration Control Board 

2. Configuration Control Panel 

3. Preliminary Design Review 

4. Critical Design Review 

5. Design Certification Review 

6. Customer Acceptance Readiness Review 

7. Flight Readiness Review 

8. Crew Procedures Change Board 

9. Mission Rules Review 

10. Launch Readiness Review 

The ASPO and the MSC directorates involved in the Apollo Spacecraft Program 
provided adequate forums for formal discussion by the MSC Safety Office of any 
hazards that required attention. This management visibility in depth, operating in 
an atmosphere that encouraged personnel with problems to come forth and be heard, 
was a major contributing factor in enhancing the safety of the Apollo missions. In 
addition to these meetings and milestone reviews, the MSC Safety Office presented 
formal analyses and assessments of systems safety and mission risks to the ASPO 
and to the Center Director at each mission Flight Readiness Review. At that time, 
the Mission Hazard Analysis (refer to the appendix), which identified safety concerns 
as well as the rationale for acceptance of the risks, was documented for the Flight 
Readiness Review Board. 


Hazardous and Critical Tests 

The MSC flight safety engineers participated with teams composed of specialists 
from varying disciplines in reviewing the development and installation of facilities, 
test procedures, and special safety procedures to support hazardous test activities 
at MSC. Chief among these were the thermal-vacuum tests conducted in the Space 
Environment Simulation Laboratory in which manned spacecraft modules were 
subjected to simulated space environments in vacuum chambers. Safety personnel 
were concerned with the safety of test personnel and test subjects. They assessed and 
evaluated the safety of the chambers including the associated plumbing, wiring, evac- 
uation systems, environmental control systems, and pressure vessels. Detailed and 
thorough operational readiness inspections and test readiness reviews were conducted 
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before commencement of manned tests. Safety personnel had key roles in these tasks 
and in the development of safety parameters and their limits for use in manned testing. 
Certified test safety officers participated in the manned tests to ensure adherence to 
these established parameters and limits. 


System Safety Assessments 

System safety assessments consisting of hazard analyses and special safety 
studies of Apollo contractor-furnished equipment, Government-furnished equipment, 
ground support equipment, and experiments were performed. These assessments were 
accomplished by (1) analyses of ground support equipment to determine interfaces with 
flight hardware that could adversely affect crew safety; (2) performance of detailed 
evaluations in those design and operational areas shown to exhibit risk potential; 

(3) performance of or participation in hazard trade-off studies of designs, operational 
procedures, and mission concepts; and (4) detailed analyses of those proposed changes 
to subsystems, operational procedures, plans, rules, and activities considered to 
have safety impact. 

To aid in the safety analysis of extremely complex systems, ’’fault-tree" 
analyses were conducted. These were logic diagrams that represented the mechanical, 
electrical, and/or chemical interfacing points between subsystems. The analyses 
were a valuable tool in identifying potential hazards. 

In the Apollo Program, hazard analyses were performed for man/ machine 
interface to isolate crew safety concerns. Trade-off studies and engineering assess- 
ments for compliance with system safety criteria were performed relating to crew 
safety, operational personnel safety, and system safety. Trade-off studies were 
also performed for specific hardware and operational areas, so that the relative crew 
risks for any of several alternative solutions might be compared. 

Operational safety assessments were performed on crew procedure changes, 
flight plans, mission rules, crew checklists, and crew training to ensure adequacy 
and compatibility of crew procedures and flight operations for each Apollo mission. 
Hazardous procedures were identified and recommendations were made to reduce the 
risk by modification of the existing procedures. The review of operational tasks 
resulted in procedure change requests, special studies of potential operational con- 
cerns, safety evaluation of mission operations, and documentation of crew and mission 
operational hazards. 

Safety evaluations of flight hardware consisted of (1) assessment of the config- 
uration, differences between vehicles to determine whether system or subsystem 
changes had introduced any new hazards into the vehicle; (2) review of waivers or 
deviations of specifications in manufacturing, test, or checkout procedures; and 
(3) sneak circuit analyses (SCA) of wiring systems to detect potential hazards from 
wiring or electrical system incompatibilities. A sneak circuit is a latent electrical 
path that can cause an unwanted function to occur or inhibit a desired function without 
regard to component failures. The SCA was first used on the Apollo 7 spacecraft and 
was performed for all subsequent spacecraft of the Apollo Program, both the LM and 
the CSM. 
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Mission Risk Assessment 


Concurrent with the effort to provide system safety assessments, each individual 
mission was analyzed as an integral unit in an effort to isolate and assess risks to 
mission operations and crew safety. Once a hazard was identified and evaluated, it 
was brought to the attention of program management. It was then tracked throughout 
the mission preparation period until corrected by an engineering or procedural change 
(usually a decision of the Configuration Change Board or Panel) or approved by the 
Safety Office and the ASPO as an acceptable risk. 

Periodic meetings were held with the safety personnel of the major contractors 
to discuss and evaluate hardware and operational problems that might have potential 
crew safety impact. The reports emanating from these meetings provided an 
up-to-date status of safety concerns under evaluation and of safety issues to be 
resolved. A safety concern was a specific hazard requiring positive action to correct; 
a safety issue was a potential hazard, the implications of which had not been completely 
resolved. The status report was forwarded to the ASPO and to the R&QA organizations 
which, in periodic meetings with safety personnel, considered each safety concern for 
proper resolution. 

A mission risk assessment was performed for each Apollo mission to provide 
a final and definitive evaluation of residual hazards and risks affecting the crew. 

The mission risk assessment supported the Flight Readiness Review at MSC. This 
report highlighted the more significant crew safety risks assessed during the mission 
buildup period, the results of analyses of these risks, and supporting rationale for 
acceptance of residual hazards, where appropriate. A portion of the Apollo 16 
Mission Risk Assessment is included in the appendix. 


Mission Monitoring and Postflight Evaluation 

The work described in previous paragraphs dealt with preflight safety activities. 
However, the responsibility of the MSC Safety Office did not end with the launch of an 
Apollo mission. Mission monitoring support was provided to enable real-time safety 
engineering support in the assessment and evaluation of mission discrepancies and 
identification of hazardous trends that might have a potential impact on crew safety 
or mission success. Continuous monitoring of flight hardware and the flightcrew made 
possible the identification of real or potential safety hazards. Recommendations for 
the resolution or elimination of these hazards were routed through the Spacecraft 
Analysis Network (SPAN) for verification by the appropriate subsystem monitor, and 
to the Mission Control Center for final approval and implementation by the Flight 
Director. 

The Safety Office further participated in the postflight review of failures and 
anomalies associated with system performance or crew procedures that had safety 
implications on succeeding missions. Any such failure or anomaly was examined at 
the appropriate contractor's plant to make a determination of the actual cause. When 
such a determination was made, the suspect part or procedure for each succeeding 
mission was reevaluated, redesigned, retested, rewritten, or eliminated. 
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Audits 


To ensure that the safety requirements were being met and that continued empha- 
sis was being placed on system safety by all participants, periodic audits were per- 
formed by the MSC Safety Office at major contractor production, assembly, checkout, 
and test facilities. The contractors were required to develop system safety checklists 
that detailed those steps introduced in their facilities to ensure adherence to the safety 
requirements. The checklists were used by MSC Safety Office personnel at the con- 
tractor facilities to provide on-the-spot assurance that the requirements were actively 
implemented. 


Motivational Programs 

To achieve a high level of safety, reliability, and quality consciousness in all 
program participants, it became evident that a singular motivational program was 
required. People tend to think of safety, reliability, and quality as abstract terms; 
the problem was to make that abstraction real, tangible, and relatable and then to 
keep the awareness of these important functions as an active effort constantly before 
them. 

The Manned Flight Awareness Program was introduced early in the Apollo Pro- 
gram to fill this need. The cooperation of a popular cartoonist was solicited to make 
his comic beagle ’’Snoopy” (from the cartoon strip ’’Peanuts”) the principal spokes- 
man for the program. Motivational posters featuring Snoopy in space togs were soon 
in evidence wherever people were at work on the Apollo Program. The Snoopy 
messages constantly emphasized the need for care and attention to detail. 

The astronauts contributed to the success of the program. They attended 
functions at each of the space-flight centers, honoring contributors to the program 
by presenting Snoopy pin awards. Apollo crewmen toured the facilities of the major 
contractors to meet the workers who were building and testing the Apollo mission 
hardware. 


Special Studies and Assessments 

As the Apollo Program matured and progressed, missions became longer and 
more complex. The NASA began to take optimum advantage of lunar surface explo- 
ration through the use of more sophisticated experiments packages and of the command 
and service module (CSM) lunar orbits by incorporation of experiment hardware in a 
bay of the service module. Each element of growth contained potential crew hazards, 
and each was the subject of a special safety assessment by the MSC Safety Office. 

The principal special assessments are discussed in the following paragraphs. 

Extravehicular activities . - The Apollo Program included a wide variety of EVA’s 
beginning with Apollo 9 when the lunar module (LM) pilot first stepped out of the LM 
while in Earth orbit. The first Apollo EVA safety assessment (conducted before the 
mission) resulted in a listing of 10 criticality 1 hazards, each of which had to be 
analyzed to determine its probability of occurrence. Each potential hazard was 
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finally deemed improbable after a lengthy rationale was prepared, which reinforced 
confidence in the hardware design and testing. None of the following 10 potentially 
hazardous events occurred. 

1. Ventricular fibrillation in the LM pilot could occur. 

2. Collision with the spacecraft might rupture the pressure garment assembly 
(PGA). 

3. The EVA astronaut might lose contact with and attachment to the spacecraft. 

4. The EVA astronaut might have a failed portable life-support system/oxygen 
purge system (PLSS/OPS). 

5. Undetected carbon monoxide might be present in the EVA astronaut PGA. 

6. The open failure of the oxygen purge system (OPS) might cause a rupture in 
the PGA. 

7. The EVA astronaut rescue capability might not be immediately available. 

8. The OPS redundancy might be lost. 

9. Degradation of the OPS would leave only marginal contingency EVA capability. 

10. Loss of the LM attitude control might render the LM unstable and would make 
recovery difficult. 

In a similar manner, the first lunar surface EVA on Apollo 11 was analyzed before 
the mission, and this analysis isolated the following 11 potentially hazardous areas of 
concern. The Safety Office prepared recommendations for the elimination or reduc- 
tion of these potential hazards and forwarded them to the appropriate organizations 
for consideration. Most of the recommendations were accepted. 

1. Pyrophoric reaction of lunar material with the LM oxygen atmosphere 
might occur. 

2. A rupture of the lunar contingency sample container might occur in the cabin. 

3. Damage to the extravehicular mobility unit (EMU) might occur if a crewman 
were to fall on the lunar surface. 

4. Crewmen might be unable to detect the presence of sinkholes, deep dust 
pits, or subsurface faults. 

5. Because of scratching or tearing on spacecraft protuberances, a compromise 
of the EMU pressure, thermal, or radiation integrity might occur. 
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6. Inability of the crewmen to obtain adequate footing on the plus-Z footpad 
could be caused by dust or debris acquired at landing. 

7. Inability to determine the temperature of tools, equipment, et cetera, could 
result in damage to the EMU upon touch. 

8. A fallen crewman might be unable to recover and return to the LM before 
the loss of EMU consumables. 

9. Crewmen ingress or egress could be difficult when the plus-Z footpad is not 
in contact with the lunar surface. 

10. Deployed television camera cable and S-band antenna cables could pose a 
tripping hazard to crewmen. 

11. The crewman inside the LM might be unable to observe the egressing 
crewman. 

Apollo lunar surface experiments .- Apollo 11 carried a comparatively simple 
package of scientific hardware for deployment on the lunar surface. These experi- 
ments, however., had some inherent potential hazards that were assessed before the 
flight. Of major concern was the fuel capsule for the radioisotopic thermoelectric 
generator used to supply power to the Apollo lunar surface experiments package. 

The capsule used plutonium-238 as its isotope, and the inadvertent release of this 
radioactive substance was a matter of great concern. The capsule was subjected to 
analysis by the Safety Office and representatives of the Atomic Energy Commission 
who concluded that the device was safe to use when used according to the prescribed 
procedures. To illustrate the thoroughness of this assessment, consideration was 
given to the possibility that the fuel capsule might be returned to the Earth atmosphere 
in the event of a mission abort. The analysis concluded that the capsule, as designed, 
was adequate to survive reentry and would release no radioactivity. This conclusion 
proved correct when the Apollo 13 mission aborted and the LM (which had served as 
a ’’lifeboat” for the astronauts when the CSM was partly disabled) reentered the 
Earth atmosphere and broke up over the Pacific Ocean. The fuel capsule was still 
on board and, as predicted by the preflight analysis, did not contaminate the atmos- 
phere with radioactive material. 

Other significant studies . - Other significant studies made between 1969 and 1972 
included a system safety engineering hazard analysis of the LM pyrotechnics and the 
CSM launch vehicle separation pyrotechnics (Feb. 1969), a LM-6 critical switch study 
(Sept. 1969), a CSM circuit breaker accessibility study (Sept. 1969), a LM circuit 
breaker review (Sept. 1969), a study of crew distractions during critical mission 
phases (Feb. 1970), a system safety assessment of the Apollo 12 anomalies and of 
the failure mechanism during the initial boost phase (Feb. 1970), a study of the active 
seismic experiment (Aug. 1970), a study of the CSM return enhancement provisions 
(Dec. 1970), and a study of the lunar seismic profiling experiment (Dec. 1972). 
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CONCLUDING REMARKS 


The success of the United States manned space-flight program has been, to a 
great extent, a direct result of the emphasis placed on safety by the management of 
the NASA Lyndon B. Johnson Space Center (formerly the Manned Spacecraft Center). 
The basic safety objective has been to identify hazards and to ensure that these 
hazards are either eliminated or reduced to an acceptable level. With the exception 
of the Apollo spacecraft 204 fire and perhaps the Apollo 13 abort, the hazards have 
been adequately identified and properly resolved. 

The reorganization of the NASA Headquarters and Lyndon B. Johnson Space Center 
safety efforts after the spacecraft 204 fire was necessary for the complex and ex- 
panded efforts of the Apollo Program. A greatly enhanced Safety Office visibility and 
comprehension of day-to-day safety status resulted in the reestablishment of a satis- 
factory approach to crew and mission safety. The fundamental change in organization 
that proved most effective was gathering the safety efforts under a single office that 
reported to the Center Director. 

The establishment of formally documented hazard analyses for each mission was 
effective in identifying all significant hazards and assuring a satisfactory resolution 
of hazards at an appropriately high level in the center organization. 

A safety program requires an adequate complement of qualified safety engineers, 
a free hand to make independent assessments, and the full support of management. 

With these ingredients, an effective safety program is assured. 

The Manned Flight Awareness Program, introduced early in the Apollo Program, 
was a motivational tool used to achieve a high level of safety, reliability, and quality 
consciousness in all program participants. Its success was greatly enhanced by 
astronaut participation. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, November 14, 1974 
039-00-00-00-72 
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APPENDIX 

APOLLO 16 MISSION RISK ASSESSMENT 
EXCERPTS AND SUMMARIES 


The following pages have been extracted as typical examples of the Apollo 16 
Mission Assessment Report. 


”1.2 PURPOSE 

The purpose of this assessment is to define and evaluate the 
risks associated with the Apollo 16 flight and lunar surface 
activities, to provide justification for discounting or accept- 
ing these risks, and to present an overall picture of the 
mission relative to crew safety. 


"1.3 SCOPE 

This document is limited to the presentation of the assess- 
ment of the Apollo 16 mission as related to flight crew safety 
from lift-off through earth landing. The assessment included 
analysis of each mission phase, including procedures, con- 
figurations, and potential impact of previously-observed 
anomalies on flight crew safety. This document applies to 
the MSC Flight Readiness commitments. Subsequent anom- 
alies are evaluated on a day-to-day basis up to the launch time 
and are incorporated into this document as required. 


"1.4 CONCLUSIONS 

1.4. 1 The new risks introduced into the Apollo 16 mission are 
acceptable and provide no flight constraints. 

1.4.2 Assessment of the planned lunar surface activities, includ- 
ing the longer EVA’s, longer traverses, and delta lunar 
surface experiments has uncovered no safety concerns 
which preclude the lunar activities or any planned lunar 
surface experiments. Improvement in the active seismic 
experiment from Apollo 14 has increased the safety margin 
for Apollo 16. 

1.4.3 Assessment of the rendezvous technique changes which are 
incorporated for Apollo 16 indicate they should minimize 
controllable errors in the rendezvous calculations, thus 
improving overall mission success and crew safety. 
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1.4.4 Boom retraction modification of adding proximity switches 
has increased safety by enabling determination if booms 

are sufficiently retracted before an SPS^ burn. (See note 1 
below. ) 

2 

1.4.5 Planned CM in-flight demonstrations have been assessed 
for concerns related to crew safety, and no constraining 
safety concerns were identified. (See note 2 below. ) 

Note 1. The mass spectrometer and gamma ray spectrometer 

3 

experiments were extended from the SM Scientific Instru- 
mentation Module by retractable booms. It is critical to 
have assurance that these booms are properly retracted 
before attempting an SPS burn; an unretracted boom could 
conceivably wrap around the SPS nozzle extension. Prox- 
imity switches were added on Apollo 16 to provide the crew 
positive assurance of boom retraction prior to the SPS 
burn. In addition, a boom jettison capability was added. 

Note 2. During transearth coast, Apollo 16 crew conducted the 

following inflight demonstrations, each requiring experi- 
ment hardware and procedures which were subjected to 
safety analysis: 

(1) ALFMED (Apollo Light Flash Moving Emulsion 
Detector) 

(2) MEED (Microbial Ecology Evaluation) 

(3) Electrophoresis In-Flight Demonstration 

(4) Biostack Experiment (M2 11) 

1.4. 6 Safety assessments of anomalies occurring during manned 

environmental tests, previous flights, and vehicle ground 
tests have disclosed no significant safety concerns. 


”1.5 RECOMMENDATIONS 

None. 


Service propulsion system. 
Command module. 

Service module. 
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” 1.6 


SAFETY STATEMENT APOLLO 16 MISSION 


The Safety Office assessment of the planned Apollo 16 
mission, spacecraft functions, and hardware failures dis- 
closed no safety concerns which constrain the Apollo 16 
flight scheduled for April 16, 1972. The assessment is 
based on safety analyses performed in coordination with 
and obtained from the Program Office, E&D, FOD, FOOD, 

4 

MR&OD, SR&QA, and the hardware contractors. ” 

Section 2.0 provided a discussion of all constraining and nonconstraining 
safety concerns evaluated during the mission assessment. These concerns were 
assessed for crew safety during the period leading to the preparation of the report 
and were published in the MSC Safety Concerns document, released biweekly. The 
information included the issue, action, and status of each concern. The following list 
enumerates the concerns contained in the Apollo 16 Mission Assessment Report. 

1. Range/range-rate meter glass shattered 

2. Command and service module (CSM) criticality 1 switches 

3. Gyro-display coupler aline function 

4. Scratched Lexan window shade 

5. Loose object in the cabin fan 

6. Unexplained pressure increase in the CSM tunnel 

7. Broken bacteria filter on water gun 

8. Main oxygen regulator failure 

9. Premature deployment of main parachute 

10. Failure of docking ring to sever 

11. Extravehicular glove wear 

12. Command module (CM) reaction control system (RCS) fuel tank 
excessive delta pressure 

13. Parachute reefing-line cutter 


Engineering and Development Directorate; Flight Operations Directorate; 
Flight Crew Operations Directorate; Medical Research and Operations Directorate; 
and Safety, Reliability, and Quality Assurance Office. 
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14. Entry monitor subsystem '’thrust on" light 

15. Pressure garment assembly qualification test failure 

16. Suited or unsuited scientific instrument module door jettison 

17. The CM RCS oxidizer tank bladder overpressure 

18. Impact test failure of helmet 

19. CSM-113 propellant utilization and gaging system anomaly 

20. Trapped CM RCS propellant overpressure 

21. Circuit breaker mechanical latch problem 

22. Earth landing system main parachute failure 

The following information is contained in the report covering item 22, which 
illustrates the depth at which each item (1 to 22) was considered. 

" Issue - The crew verified and photographic coverage confirmed that one 
main parachute collapsed at an altitude of 6,000 feet during the Apollo 15 
mission. Four of the six nylon risers had released their suspension-line 
load. Loss of one main parachute exposed the crew to higher, but acceptable, 
loads; however, failure of more than one parachute could result in crew loss. 

5 

" Action - An NR investigation and analysis revealed the cause of main para- 
chute collapse not to be forward heat shield, the suspension links, or the steel 
risers being pulled from the flower pot. The most probable cause of the 
anomaly was the burning raw fuel (monomethylhydrazine) being expelled during 
later portions of the depletion firing. This resulted in the exceeding of the 
parachute-riser and suspension- line temperature limits. Corrective action 
taken has been to change the mode 1A abort timer to 61 seconds, to design 
and qualify new connection links made of Inconel 718, to load propellants to 
achieve a slightly oxidizer-rich mixture for a possible depletion- burn purge, 
and to require certification of the CM to land in the water with pressurized 
propellants onboard. Oxidizer and parachute tests at the NASA WSTF 
(White Sands Test Facility) are being conducted to investigate the effects of 
the CM RCS dump burn depletion and purge on the parachute assemblies. 
Recovery procedures and training are being updated to avoid possible 
crew exposure to toxic propellants as a result of the single failure points 
of the pressurized tanks at shutdown. 
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"Status - The concern has been closed on the basis of: 


(a) The decision to land on water with pressurized tanks and 

(b) The decision to extend the mode 1Z regime. The Safety Office will 
continue to scrutinize the current WSTF RCS/oxidizer tests for impact. " 

Section 3.0 of the Mission Assessment Report contained the Flight Operations 
Safety Analysis. The analysis was divided into approximately nine areas with each 
addressing a mission phase; for example, launch through orbit insertion, lunar 
orbit insertion, lunar module powered descent, lunar surface activities, et cetera. 

Section 4.0 defined the safety evaluation of flight hardware differences 
between the mission under assessment and previous missions, the waivers and 
deviations, and the sneak circuit analyses for the upcoming mission. 

Section 5.0 covered the manned environmental ground tests pertinent to the 
upcoming mission performed at the Space Environment Simulation Laboratory 
at the MSC. 

Section 6.0 subjected anomalies from previous missions to analysis. Includ- 
ed were numerous anomalies from the previous missions that were evaluated for 
safety impact; breakdown by command and service module, lunar module, and 
Government-furnished equipment; and the status of each with respect to the up- 
coming mission. 

Section 7.0 was an evaluation of real-time flight problems and was not con- 
tained in the first two releases of the Mission Assessment Report; this section was 
added after splashdown and recovery. 
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